IN THE CLAIMS 

Please cancel claims 16-27 without prejudice. 

1 . (previously presented) A computer-implemented method for analysis of executable 
program code, the executable program including segments of code that correspond to callable 
functions in source code from which the executable code was generated, comprising: 

reading from the executable program code pairs of entry points and endpoints, each 
pair including an entry point and an endpoint that are associated with a callable function in 
the source code and corresponding to a segment of the executable program code; 

generating analysis data for the functions identified by the pairs of entry points and 
end points; 

detecting execution of stub functions at runtime; and 
bypassing analysis of stub functions. 

2. (original) The method of claim 1, further comprising scanning the executable program 
code for selected characteristics using the pairs of entry points and endpoints. 

3. (original) The method of claim 1, further comprising: 

executing the program code; 

detecting execution of the functions using the pairs of entry points and endpoints; and 
recording selected execution characteristics of each executed function. 

4. (original) The method of claim 1, wherein the executable program code includes one or 
more dynamic load modules, the method further comprising: 

reading entry points of initializer and deinitializer functions from dynamic load 
modules; 

pairing the entry points of the initializer and deinitializer functions with endpoints of 
the initializer and deinitializer functions; and 

generating analysis data for the initializer and de-initializer functions identified by the 
pairs of entry points and end points of the initializer and deinitializer functions. 

5. (original) The method of claim 4, wherein the executable program code includes a 
procedure lookup table (PLT) table associated with the one or more dynamic load modules, 
the method further comprising: 
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reading function entry points from the PLT; 

pairing the entry points from the PLT with endpoints; and 

generating analysis data for the PLT functions identified by the pairs of entry points 
and end points of the PLT functions. 

6. (original) The method of claim 4, further comprising scanning the executable program 
code for selected characteristics using the pairs of entry points and endpoints. 

7. (original) The method of claim 4, further comprising: 

executing the program code; 

detecting execution of the functions using the pairs of entry points and endpoints; and 
recording selected execution characteristics of each executed function. 

8. (original) The method of claim 4, wherein the program code includes a symbol table 
identifying one or more function entry points, the method further comprising: 

reading entry points of functions from the symbol table; 
pairing the entry points from the symbol table with endpoints; and 
generating analysis data for the symbol table functions identified by the pairs of entry 
points and end points of the symbol table functions. 

9. (original) The method of claim 1, wherein the program code includes a symbol table 
identifying one or more function entry points, the method further comprising: 

reading entry points of functions from the symbol table; 
pairing the entry points from the symbol table with endpoints; and 
generating analysis data for the symbol table functions identified by the pairs of entry 
points and end points of the symbol table functions. 

10. (original) The method of claim 1 , further comprising: 

detecting function calls at runtime; 

finding the entry point of a runtime-detected function call; 
pairing an endpoint with the entry point of a runtime-detected function call; and 
generating analysis data for functions identified by pairs of entry points and end points 
of the runtime-detected function calls. 
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11. (canceled) 

12. (canceled) 

13. (original) The method of claim 10, wherein the executable program code includes one or 
more dynamic load modules, the method further comprising: 

reading entry points of initializer and deinitializer functions from dynamic load 
modules; 

pairing the entry points of the initializer and deinitializer functions with endpoints of 
the initializer and deinitializer functions; and 

generating analysis data for the initializer and de-initializer functions identified by the 
pairs of entry points and end points of the initializer and deinitializer functions. 

14. (original) The method of claim 13, wherein the executable program code includes a 
procedure lookup table (PLT) table associated with the one or more dynamic load modules, 
the method further comprising: 

reading function entry points from the PLT; 

pairing the entry points from the PLT with endpoints; and 

generating analysis data for the PLT functions identified by the pairs of entry points 
and end points of the PLT functions. 

15. (previously presented) An apparatus for analysis of executable program code, the 
executable program including segments of code that correspond to callable functions in 
source code from which the executable code was generated, comprising: 

means for reading from the executable program code pairs of entry points and 
endpoints, each pair including an entry point and an endpoint that are associated with a 
callable function in the source code and corresponding to a segment of the executable 
program code; 

means for generating analysis data for the functions identified by the pairs of entry 
points and end points; 

means for detecting execution of stub functions at runtime; and 
means for bypassing analysis of stub functions. 
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16. (canceled) 

17. (canceled) 

18. (canceled) 

19. (canceled) 

20. (canceled) 

21. (canceled) 

22. (canceled) 

23. (canceled) 

24. (canceled) 

25. (canceled) 

26. (canceled) 

27. (canceled) 



